Accessing all appointments vulnerability

How it was found

Hi there,

This is another vulnerability which allow users without privilege to access appointments ( permission of access scheduling ) is turned off to access or view all appointments within offices.

What the attacker will do is make use of the print appointment feature. Basically accessing directly: https://trizaeron.drchrono.com/examroom_printer_friendly/74506/20150401/20150504

Take note that 74506 is the office id and 20150401/20150504 are just dates.

In case you wanted more information, let me know. Clifford